Basic Data Carving Test #2

Digital Forensics Tool Testing Image (#12)

Introduction

This test image is an EXT2 file system and is intended to test data carving
tools for indirect block detection and removal. With large files, EXT2 allocates blocks (called indirect blocks) to store
file metadata and the blocks are frequently allocated in between blocks that contain file content. Therefore, the file becomes fragmented and a basic carving tool may include the indirect block in the carved file. This file system image contains
several allocated and deleted files, none of which have been
modified. This image was created from a USB thumb drive that was
wiped clean and formatted using the mkfs.ext2 program.
The super block has been corrupted so that the image cannot be
mounted and therefore data carving methods must be used to extract
the files.

Download

This test image is a 'raw' partition image (i.e. 'dd') of an EXT2 file system.
The file system is 124MB and is compressed to 1.1MB. The MD5 of the image is
6cbd2c5248fa7030d699eb6cde051623. This image is released under the
GPL, so anyone can use it.